erik-krogh
a826dbbdee
fix capitalization in stack-trace-exposure
2022-10-11 13:59:10 +02:00
erik-krogh
4da0508dae
Merge branch 'main' into py-last-msg
2022-10-11 10:49:19 +02:00
Rasmus Wriedt Larsen
4b1f6f0865
Merge pull request #10629 from RasmusWL/fix-flask-source
...
Python: Fix flask request modeling
2022-10-10 09:56:22 +02:00
erik-krogh
6fdfd40880
changes to address reviews
2022-10-07 22:31:00 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
Rasmus Wriedt Larsen
05bca0249c
Python: Expand test for py/flask-debug
...
(I couldn't see one using positional argument)
2022-10-04 20:39:08 +02:00
Rasmus Wriedt Larsen
b01a0ae696
Python: Adjust .expected after flask source change
...
It's really hard to audit that this is all good.. I tried my best with
`icdiff` though -- and there is a problem with
ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
that needs to be fixed in the next commit
2022-10-03 20:35:49 +02:00
Rasmus Wriedt Larsen
a0fcd4a9bf
Merge pull request #10631 from RasmusWL/cleanup-options-files
...
Python: Remove last `-p ../lib/` in `options` files
2022-10-03 11:09:59 +02:00
Nick Rolfe
ed74e0aad1
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 10:37:52 +01:00
Rasmus Wriedt Larsen
ea27f4e20f
Python: Remove last -p ../lib/ in options files
...
These were only needed for points-to.
If they only contained `--max-import-depth`, I've removed the `options`
file entirely.
2022-09-29 18:05:51 +02:00
erik-krogh
7675571daa
fix RegExpEscape::getValue having multiple results for some escapes
2022-09-27 13:25:23 +02:00
Rasmus Wriedt Larsen
8174120916
Python: Model flask.jsonify
2022-09-22 14:43:39 +02:00
Rasmus Wriedt Larsen
078d3d0062
Python: Add stacktrace exposure example
2022-09-22 14:27:49 +02:00
Rasmus Wriedt Larsen
253d9cf39f
Python: Fix imports for tarslip tests
...
This doesn't change results, but makes the test-code more valid
2022-09-20 17:25:46 +02:00
Rasmus Wriedt Larsen
5f6e3dcc2e
Python: Revert changes to sensitive data query alert messages
...
This partly reverts the changes from https://github.com/github/codeql/pull/10252
Although consistency is nice, the new messages didn't sound as natural.
New alert message would read
> Insecure hashing algorithm (md5) depends on sensitive data (password). (...)
I'm not sure what it means that a hashing algorithm depends on data. So
for me, the original text below is much easier to understand.
> Sensitive data (password) is used in a hashing algorithm (md5) that is insecure (...)
Same goes for the other sensitive data queries.
2022-09-06 12:01:24 +02:00
erik-krogh
089ce5a8a4
change alert messages of path queries to use the same template
2022-09-02 14:45:40 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Rasmus Wriedt Larsen
3d0c23e441
Python: Accept .expected for TarSlip
...
Changed after merging https://github.com/github/codeql/pull/9579 ,
which improved our handling of `not` for guards.
2022-08-03 09:52:11 +02:00
Erik Krogh Kristensen
ff25451699
rename query to overly-large-range, and rewrite the @description
2022-07-12 16:02:46 +02:00
Erik Krogh Kristensen
a343ceaf8b
add suspicious-regexp-range query
2022-06-28 09:49:27 +02:00
Rasmus Wriedt Larsen
9e154ff4bd
Merge branch 'main' into python/port-tarslip
2022-06-27 14:36:15 +02:00
Erik Krogh Kristensen
13482fc97b
rename ReDoSUtil to NfaUtils, and rename the "performance" folder to "regexp"
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
yoff
f14a90ff09
Merge pull request #9200 from tausbn/python-modernise-weak-file-permissions-query
...
Python: Modernise weak file permissions query
2022-06-15 14:37:17 +02:00
yoff
9dbb451f41
Merge pull request #9463 from RasmusWL/req-wo-cert-validation
...
Python: Rewrite `py/request-without-cert-validation`
2022-06-15 13:00:57 +02:00
Rasmus Lerchedahl Petersen
f4ce382b7d
python: update test expectations
2022-06-15 12:40:14 +02:00
Rasmus Lerchedahl Petersen
7b5d9ec7df
python: Straight port of tarslip
2022-06-14 15:01:13 +02:00
Taus
5b9c668e10
Python: Restrict test to Python 3
2022-06-14 12:58:35 +00:00
Alex Ford
8d195e3188
Merge pull request #9157 from alexrford/crypto-op-block-mode
...
Ruby/Python: Add a `BlockMode` concept for `CryptographicOperations`
2022-06-13 21:32:36 +02:00
Rasmus Wriedt Larsen
c21e05aa44
Python: Use HTTP::Client::Request request for py/request-without-cert-validation
...
This is very much like the Ruby query, except we also have the origin
that does the disabling.
976daddd36/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql (L18-L20)
2022-06-08 15:42:32 +02:00
Rasmus Wriedt Larsen
9cb249fc2f
Python: Add test we don't handle for py/request-without-cert-validation
2022-06-08 15:39:37 +02:00
Taus
3745526d69
Merge pull request #9108 from RasmusWL/promote-pam
...
Python: Promote `py/pam-auth-bypass`
2022-05-23 15:27:12 +02:00
Rasmus Wriedt Larsen
b54de13d97
Python: Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2022-05-18 10:30:29 +02:00
Taus
b2fe615ef2
Python: Modernise weak file permissions query
...
Using API graphs instead of points-to.
Unfortunately, some results will be lost because of this, due to the
fact that points-to tracks bitwise operations on small numbers (i.e.
flags), whereas API graphs does no such thing. This means using
something like `stat.S_IWUSR | stat.S_IWGRP` will not work.
A custom type tracker (like the one used for `re` flags) could be used
to recapture this behaviour, but I think that's best left as future
work, as it's not clear to me that this query is actually worth the
effort it would take to implement this.
2022-05-17 20:20:15 +00:00
Taus
ea32299ab0
Python: Use API-graph flow for boolean tracking
...
Introduces a false positive, but arguably that false positive should
have been there with the local flow as well.
2022-05-17 13:14:55 +00:00
Alex Ford
bc073eb460
python: update py/weak-cryptographic-algorithm to flag use of ECB block mode
2022-05-13 16:32:36 +01:00
Rasmus Wriedt Larsen
0956d506de
Python: Actually promote py/pam-auth-bypass
...
🤦
2022-05-11 13:44:47 +02:00
Rasmus Wriedt Larsen
5f01fc24e4
Merge branch 'main' into promote-xxe
2022-05-02 11:25:55 +02:00
yoff
76f2eca1ee
Merge pull request #8560 from erik-krogh/movePolyTest
...
PY: move the polynomialbacktracking-test to the test folder
2022-04-26 14:21:30 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Rasmus Wriedt Larsen
23637fd691
Merge branch 'main' into promote-xxe
2022-04-06 12:56:31 +02:00
Rasmus Wriedt Larsen
4d2a3b38d2
Merge pull request #8511 from RasmusWL/use-query-suffix
...
Python: Use `Query.qll` suffix for dataflow configuration definitions
2022-04-06 11:59:29 +02:00
Tom Hvitved
57f2a74636
Python: Implement ContentSet
2022-04-04 13:51:44 +02:00
Rasmus Wriedt Larsen
4abab22066
Python: Promote XXE and XML-bomb queries
...
Need to write a change-note as well, but will do that tomorrow
2022-03-31 18:47:50 +02:00
Erik Krogh Kristensen
36db492aa2
move the polynomialbacktracking-test to the test folder
2022-03-28 13:22:26 +02:00
Rasmus Wriedt Larsen
88184ba9f5
Python: Update path-injection .expected
...
AHA! This change happened because we are no longer importing all the old
deprecated implementation.
2022-03-21 20:24:12 +01:00
Arthur Baars
9412b331db
Revert "Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql""
...
This reverts commit 6d24591416
2022-03-18 16:31:22 +01:00
